CVE-2023-52355

Published: 25 January 2024

An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.

Notes

Priority reason:
The fix for this issue is in the documentation for applications to ensure they properly limit memory usage.

texmaker added an embedded copy of libtiff in bionic

fix in documentation only, marking all Ubuntu releases as
ignored, as the fix in Documentation won't be of any usage in backports.
if that is not the case, I'll be happy to move it back to an active status.

Status

Severity score breakdown

References

• https://gitlab.com/libtiff/libtiff/-/merge_requests/553
• https://access.redhat.com/security/cve/CVE-2023-52355
• https://www.cve.org/CVERecord?id=CVE-2023-52355
• NVD
• Launchpad
• Debian

Bugs

• https://gitlab.com/libtiff/libtiff/-/issues/621
• https://bugzilla.redhat.com/show_bug.cgi?id=2251326